Most recent entries from all

bdu:2022-05895

Withdrawn: BELL-CVE-2020-15705 — CVE-2020-15705 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2020-avi-476 — De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Elles permettent à un attaquant de provoq…

certfr-2020-avi-476

cnvd-2021-16938

EUVD-2026-177321

fkie_cve-2020-15705

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.

GHSA-w739-fjv8-98pq

gsd-2020-15705

ICSA-21-336-06 — Hitachi Energy APM Edge

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). Hitachi Energy is aware of public reports of this vulnerability in the following open-source software components: OpenSSL, LibSSL, libxml2 and GRUB2 bootloader. The vulnerability also affects some APM Edge products. An attacker who successfully exploits this vulnerability could cause the product to become inaccessible. SEE NVD for full Description. In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not a…

msrc_CVE-2020-15705 — GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

msrc_CVE-2020-15705

openSUSE-SU-2020:1280-1 — Security update for grub2

Security update for grub2

RHSA-2020:3216 — Red Hat Security Advisory: grub2 security update

grub2: Crafted grub.cfg file can lead to arbitrary code execution during boot process grub2: grub_malloc does not validate allocation size allowing for arithmetic overflow and subsequent heap-based buffer overflow grub2: Integer overflow in grub_squash_read_symlink may lead to heap-based buffer overflow grub2: Integer overflow read_section_as_string may lead to heap-based buffer overflow grub2: Integer overflow in grub_ext2_read_link leads to heap-based buffer overflow grub2: Fail kernel validation without shim protocol grub2: Use-after-free redefining a function whilst the same function is already executing grub2: Integer overflow in initrd size handling

SUSE-SU-2020:14461-1 — Security update for grub2

Security update for grub2

UBUNTU-CVE-2020-15705

Affected: Ubuntu:Pro:14.04:LTS: grub2, Ubuntu:Pro:14.04:LTS: grub2-signed, Ubuntu:16.04:LTS: grub2, Ubuntu:16.04:LTS: grub2-signed, Ubuntu:16.04:LTS: grub2-unsigned, Ubuntu:18.04:LTS: grub2, Ubuntu:18.04:LTS: grub2-signed, Ubuntu:20.04:LTS: grub2, Ubuntu:20.04:LTS: grub2-signed

WID-SEC-W-2022-0553 — Grub2: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Ein lokaler Angreifer mit Administratorrechten oder physischem Zugriff auf das Gerät, kann mehrere Schwachstellen in Grub2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen.